Brazil's data protection authority has fined ByteDance, TikTok's parent company, nearly $30 million, finding that the platform collected and processed children's personal information without a valid legal basis or adequate safeguards, Al Jazeera reports.
The regulator estimated that data from at least 8 million children had been processed, and identified what it called systemic deficiencies in the platform's age-verification mechanism. It found breaches across both logged-in accounts and guest browsing.
The feature at the centre of it
Brazil has a "logged-out feed", which lets people browse TikTok without creating an account. It is not available in the United States or Europe.
The regulator's finding is that this feed "enables widespread use of the platform by minors while bypassing age-verification checks", which is the whole case in one sentence. Age verification happens at sign-up. A product that lets you watch without signing up has, by design, no point at which anyone's age is checked.
That a company offers this feature in Brazil and not in jurisdictions with stricter enforcement is the detail regulators elsewhere will notice.
What was ordered
Beyond the fine, TikTok must erase all the data it obtained unlawfully and build what the authority describes as an improved comprehensive youth-protection framework.
The deletion order is the more significant remedy. A fine of $30 million is a manageable cost for a company of ByteDance's size; deleting the accumulated behavioural data of 8 million young users removes something that cannot be bought back.
TikTok can appeal within ten days. The report contains no response from the company, and we have not obtained one.
The pattern
This is the second substantial child-data penalty against the platform we have covered recently, after it agreed to pay $400m to settle US claims. Different jurisdictions, different legal bases, the same underlying question about who is watching and how old they are.
What we could not establish
We could not establish the fine in Brazilian currency, the specific provisions breached, how the 8 million figure was calculated, whether TikTok intends to appeal, or whether the logged-out feed will be withdrawn. We verified this account from a single publication.
